Cognitiv
Legal
Privacy policy
Last updated: 26 September 2026
This policy explains how we process personal data when you visit cognitiv.so, contact us, sign up or use Cognitiv, and what role we play when our customers' agents process data about their own customers. Cognitiv is a service for businesses.
1. Who is the controller
The controller is MAJENTIA FORMACION Y DESARROLLO, S.L. (“Majentia”, “we”), Spanish tax ID (NIF) B27683648, registered address Calle José Enrique Marrero Arquitecto, 21, 35017 Las Palmas de Gran Canaria (Las Palmas), Spain. Contact email, including for privacy matters: hola@cognitiv.so.
We have not appointed a data protection officer because our current activity does not require one. The team handles any privacy question at the address above.
2. Our two roles
- Controller of the data of people who visit the website, contact us, or are users or customers of Cognitiv (accounts, billing, support, security and communications). Sections 3 to 11 refer to this role.
- Processor (Art. 28 GDPR) when a business customer uses Cognitiv so that its agents serve its own customers, employees or contacts (for example over WhatsApp, Instagram, Messenger, email or Slack). The business customer is then the controller and decides what that data is used for. See section 4.
3. What data we process, why, and on what legal basis
| Activity | Data | Purpose | Legal basis |
|---|---|---|---|
| Website visits | IP address, browser, pages requested, date and time (technical logs of the server and the delivery network) | Serve the website, keep it secure and detect abuse | Legitimate interest in the security and operation of the site (Art. 6(1)(f) GDPR) |
| Contact form and early-access list | Name, work email, company, the workflow you describe, language and request type. To limit abuse, hashes of the IP address and email kept only in memory for 10 minutes | Reply to your request and manage your early-access place | Steps taken at your request before a contract (Art. 6(1)(b)) and legitimate interest in preventing form abuse (Art. 6(1)(f)) |
| Sign-up and user accounts | Email, name, role, sign-in data (access links or codes, sessions) and sign-up history | Create and manage the account, authenticate and control access | Performance of the contract or pre-contractual steps (Art. 6(1)(b)) and legitimate interest in security (Art. 6(1)(f)) |
| Billing and payments | Billing email, Stripe customer and subscription identifiers, amounts and payment status. Card details, billing address and VAT ID are collected by Stripe directly; we never see the card number | Charge the subscription, issue invoices, handle failed payments and refunds, meet tax and accounting obligations | Performance of the contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) |
| Fraud prevention at sign-up and payment | Keyed hash of the IP address, normalised email and the result of Stripe's fraud checks | Prevent fraudulent sign-ups and abuse | Legitimate interest in preventing fraud (Art. 6(1)(f) and Recital 47) |
| Support | Contact details, description of the issue and anything you send us (for example screenshots) | Resolve issues and questions | Performance of the contract (Art. 6(1)(b)) |
| Product communications | Name and email | Tell customers about service updates similar to what they use | Legitimate interest (Art. 6(1)(f) and Art. 21(2) of the Spanish LSSI) for customers; consent (Art. 6(1)(a)) for everyone else. You can object at any time. The contact form does not subscribe you to anything |
| Platform security and backups | IP address, user agent, access events and technical logs; backups also contain the data above | Detect abuse, audit access, respond to incidents and be able to restore the service | Legitimate interest (Art. 6(1)(f)) and the legal duty of security (Arts. 6(1)(c) and 32 GDPR) |
Fields marked as required in each form are needed to handle your request or provide the service; without them we cannot do so.
4. When we process data on behalf of our customers
Cognitiv lets a business create AI agents that read and answer messages, consult the business's internal knowledge and carry out tasks in the tools the business connects. The data those agents process (conversations with the business's end customers, attachments, documents, data from its CRM or systems, and the actions the agent takes) belongs to the business customer, which is the controller. We process it as a processor, only on the customer's instructions and under the data processing agreement (Art. 28 GDPR) we sign with the customer before processing personal data on its behalf.
- We do not use that data for our own purposes, we do not sell it and we do not use it to train AI models.
- If you wrote to a business that uses Cognitiv and want to exercise your rights, contact that business. If you write to us instead, we will pass your request to the business and help it respond.
- To generate replies, the content an agent needs is sent to an AI model provider. There are two modes: (a) Cognitiv supplies model access (today, in managed services): the provider (Anthropic, OpenAI, Google or OpenRouter, whichever is used) is our sub-processor, under its data processing agreement and the transfer safeguards in section 8; (b) the customer uses its own API keys (self-service): the customer chooses and contracts the provider and needs its own agreement with it, and we only send it content on the customer's instruction.
- The channels and tools the customer connects (WhatsApp, Instagram, Messenger, Slack, Telegram, Discord, its email, Google Workspace, Microsoft 365, its CRM…) are services the customer contracts. Each processes data under its own terms.
5. Data from WhatsApp, Instagram and Messenger
When a business customer connects its WhatsApp Business account, Instagram professional account or Facebook Page to Cognitiv, we access, through the Cognitiv app on Meta's platform and its official APIs, and only with the permissions the business grants:
- the messages people send to that business and the replies from the business or its agents, with their attachments;
- the sender identifiers Meta provides (phone number or WhatsApp ID, Instagram-scoped or Page-scoped ID and, where Meta provides it, the profile name);
- message metadata (date, time, delivery and read status);
- the business account data needed to run the connection (WhatsApp Business account, phone number, Page or Instagram account identifiers, name and access tokens).
We use this data only so the business's agents can receive and answer messages, to show conversations to its team in the workspace and to hand a conversation over to a person when needed. We do not use it for advertising, we do not sell it, we do not share it with third parties other than the providers needed to run the service (section 7) and the AI model provider that generates the reply (section 4), and we do not use it to train or improve AI models.
It is kept while the business keeps the connection and according to the retention it has configured; when the channel is disconnected or the account is closed it is deleted as described in section 9. Meta keeps its own copy under its terms (for example, the WhatsApp Cloud API stores messages for up to 30 days). How to request deletion: data deletion.
6. Artificial intelligence and automated decisions
Cognitiv agents are AI systems and people who talk to one must know it (Art. 50 of the EU AI Act). We are adding a default notice at the start of the conversation to every channel; in the meantime, and in any case, our terms require customers to say so, unless it is obvious, and to always offer a way to reach a person.
We do not take decisions based solely on automated processing that produce legal effects on you or similarly significantly affect you (Art. 22 GDPR). What a customer's agent does is configured by that customer, who can require a person's approval before any action.
7. Who we share data with
We do not sell personal data. We share it only with providers that help us run the service, under data processing terms and the safeguards the GDPR requires, and with authorities when the law requires it.
Cognitiv is in a pilot phase: some of these providers (backup storage on AWS and Cloudflare R2) are being brought in now. We will keep this list up to date and tell customers about changes.
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Servers hosting the website and the service | Germany and Finland (EU) |
| Cloudflare, Inc. | Delivery network, protection and TLS termination of traffic; the demo downloads an animation library from cdnjs (Cloudflare), which receives your IP address; secondary copy of backups (Cloudflare R2, EU jurisdiction) | Global network; backup storage in the EU |
| Amazon Web Services EMEA SARL | Encrypted backup storage, temporarily while we complete the move to Cloudflare R2 | EU region |
| Stripe Payments Europe Ltd. | Payments, subscriptions, invoices and fraud prevention. Stripe is also an independent controller for its own fraud and compliance purposes | Ireland, with transfers to the US |
| Resend (Plus Five Five, Inc.) | Service emails (sign-in, invitations) and delivery of contact-form messages to our mailbox | US |
| Anthropic, OpenAI, Google, OpenRouter (whichever is used) | AI models that generate agents' replies, when Cognitiv supplies model access (section 4) | US and other countries outside the EEA |
| Corporate email provider | The hola@cognitiv.so mailbox, where we receive requests and support | Depends on the provider |
| Accounting and tax advisers, banks | Accounting and tax obligations | Spain |
When we act on behalf of a customer, the services that customer chooses and connects are also involved (its AI model provider when it uses its own key, Meta for WhatsApp, Instagram and Messenger, and other channels and integrations), as described in section 4.
8. International transfers
Some providers are in the United States or may access data from there (Cloudflare, Stripe, Resend and, when processing on behalf of customers, AI model providers and Meta). These transfers rely on the EU-US Data Privacy Framework where the provider is certified, or on the standard contractual clauses approved by the European Commission (Decision 2021/914), with supplementary measures where appropriate. When Cognitiv supplies model access, we hold those safeguards with the provider; when the customer uses its own key, the customer does. You can ask us for more information or a copy of the safeguards at hola@cognitiv.so.
9. How long we keep data
- Website and security logs: as long as needed for security, normally no more than 30 days, unless an incident requires keeping them longer.
- Contact-form requests: while we handle the request and up to 12 months after the last contact, unless you become a customer.
- User accounts: while the account is active. When it is closed, the account owner's email is kept blocked for the billing retention period.
- Fraud-prevention data: as long as needed for that purpose.
- Product communications: until you object or unsubscribe.
- Billing data: 6 years (Art. 30 of the Spanish Commercial Code), which also covers the 4-year tax period.
- Support: 2 years after the issue is closed.
- Data processed on behalf of customers: the periods set in the customer's contract. When an account is closed, the customer has 30 days to export its data; after that it is deleted.
- Backups: they rotate automatically. Deleted data disappears from them as they expire, within approximately 40 days.
When a period ends we delete or anonymise the data. If a law requires us to keep it longer, we keep it blocked, for that purpose only.
10. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and portability, and withdraw any consent you gave us at any time, without affecting earlier processing. Email us at hola@cognitiv.so saying which right you want to exercise. If we have reasonable doubts about your identity, we may ask for additional information to confirm it.
We reply within one month, which may be extended by two further months for complex requests (we will tell you). If you believe we have not handled your request properly, you can complain to the Spanish Data Protection Agency (www.aepd.es, C/ Jorge Juan 6, 28001 Madrid) or to the supervisory authority where you live.
11. Security
We apply technical and organisational measures appropriate to the risk (Art. 32 GDPR), including encryption of traffic (TLS), separation of each customer's data, least-privilege access control, encrypted backups and activity logs. No system is invulnerable; if a security breach affects you, we will act and inform you as the law requires.
12. Minors
Cognitiv is a service for businesses and is not directed at minors. We do not knowingly collect data from children under 14. If you believe we have received such data, contact us and we will delete it.
14. Changes to this policy
If we change this policy, we will publish the new version on this page with its date. If the change is significant, we will also tell customers by email.